Sanctions screen for an EVM wallet: one deterministic read of the public Chainalysis sanctions oracle contract. Call it mid-transaction before settling with an unknown counterparty — no account, no API key, one paid call returns sanctioned true/false with the oracle address for independent verification. Fail-closed: if the oracle is unreachable you get an error, never a false all-clear.